Comment 136 for bug 357864

(In reply to Ben Bucksch (:BenB) from comment #129)
> (In reply to Josiah Bruner [:JosiahOne] (needinfo > CC) from comment #125)
> > UI-Review:
> > - "Customize From Address" is confusing. “Enter a custom address” perhaps?
>
"Customize From Address"|"Edit Sender" vs. "Enter a custom address" are two different design concepts.

"Customize/edit..." assumes we're using existing identities (including their predefined smtp), and only allow changing the sender string. This design does not work well as a dropdown entry at the end of the list, but requires UI elements/procedures to start from the currently selected sender identity.

"Enter a custom address" (as last entry from dropdown list) suggests we allow adding a *new* sender, which would most certainly require to allow picking SMTP, too (because otherwise from this design it would not be clear which SMTP will be used).

Both concepts have their advantages and disadvantages, which we are in the process of discussing.

>
> > - What if users try to use it as a separate address and they don’t actually
> > have the account added to TB. Any replies to it will never show up.
> > * (I'm thinking of naive users who think they can enter whatever address
> > they "own" here without bothering to add the actual account, and expect us
> > to add it automatically or something.
> > - Is this going to encourage spam sending? I can send a message as
> > “<email address hidden>” now. I understand the capability was there already,
> > but now it’s going to be even easier to do. This feature could be seriously
> > abused.
>
> You question this whole feature, its very nature.

Fortunately, it's allowed to question the nature of a feature.
This feature is very questionable, and comes with a high potential for user errors.

> Spammers don't need Thunderbird, they have specialized tools. And spammers
> already do this in billions.

+1

> This feature might actually help educating
> users how easy it is to forge email addresses, and to be more careful when
> they see From: <email address hidden> "Please update your address".

Well, maybe. I believe its more likely we'll end up with users who accidentally break their communications (failing deliveries; not getting replies).

> > - What server are we actually sending this message through? We should
> > probably have some capability to choose which one.
>
> * If you really want to pref this feature away, I think the best way would
> be a checkbox in "Account Settings..." | "Manage Identities...".
> * If we insist that only one account can have this checkbox checked, it
> would solve the "which SMTP server" question
> * But it would make this feature very obscure and hard to find.

+1. Limiting this feature to one account is not required and very poor design.

For ux-error-prevention, I suggest that this feature should not be actively promoted in the primary UI.
There might be several ways of achieving this, e.g.
- pref-out for each identity
- allow editing only after double-click on sender (plus first-time warning)